deploy-aws.yml

name: Deploy to AWS

on:
  push:
    branches: [dev, staging, main]
  pull_request:
    branches: [dev, staging, main]
  workflow_dispatch:
    inputs:
      confirmation:
        description: 'Type "YES" to confirm resource deployment'
        required: true

permissions:
  id-token: write
  contents: read

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    environment: ${{ github.ref_name == 'main' && 'prod' || github.ref_name }}
    if: github.event.inputs.confirmation == 'YES' || github.event_name != 'workflow_dispatch'
    steps:
      - name: Checkout repository
        uses: actions/checkout@v1

      - name: Setup Node.js
        uses: actions/setup-node@v1
        with:
          node-version: '18'

      - name: Install dependencies
        run: npm ci

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Set SST secrets
        run: |
          npx sst secrets set OPENAI_API_KEY ${{ secrets.OPENAI_API_KEY }}

      - name: Deploy
        run: |
          if [[ ${{ github.ref }} == 'refs/heads/dev' ]]; then
            npx sst deploy --stage dev
          elif [[ ${{ github.ref }} == 'refs/heads/staging' ]]; then
            npx sst deploy --stage staging
          elif [[ ${{ github.ref }} == 'refs/heads/main' ]]; then
            npx sst deploy --stage prod
          fi

      - name: Print caller identity
        run: aws sts get-caller-identity